Analysis

  • max time kernel
    152s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 17:56

General

  • Target
    JBeam-Forge-0.19.11-portable.exe
  • Size 123.7MB
  • Sample261107-wh2kdszzaz
  • SHA256 a9cb21507a6243f1bcd1d50283eb34fe8ed7e5cc7bac4e2f446bd799bc9dba5d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JBeam-Forge-0.19.11-portable.exe
    "C:\Users\Admin\AppData\Local\Temp\JBeam-Forge-0.19.11-portable.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5784
    • C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe
      "C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe
        "C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\jbeam-forge" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1900,i,11824218727766273197,16143268249109239831,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,8878107910554289909,755470063894391981,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5896
      • C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe
        "C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\jbeam-forge" --field-trial-handle=1900,i,11824218727766273197,16143268249109239831,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,8878107910554289909,755470063894391981,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1968 /prefetch:11
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:5324
      • C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe
        "C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\jbeam-forge" --app-path="C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1900,i,11824218727766273197,16143268249109239831,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,8878107910554289909,755470063894391981,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2972 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1536
      • C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe
        "C:\Users\Admin\AppData\Local\Temp\3LXxPxcTzr9VQvDijjH84IgCdlt\JBeam Forge.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\jbeam-forge" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1900,i,11824218727766273197,16143268249109239831,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,8878107910554289909,755470063894391981,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2908 /prefetch:10
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Network Service Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\LICENSES.chromium.html
        • Size 19.5MB
        • SHA256 7b328b8c7463ac9bfc7dc648c751533517c8441a0b5b21047d6c0b2620e60d70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\chrome_100_percent.pak
        • Size 702KB
        • SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\chrome_200_percent.pak
        • Size 1.2MB
        • SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.5MB
        • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxcompiler.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\dxcompiler.dll
        • Size 24.6MB
        • SHA256 e389f028b89a7a1459e730968a1fb8e4218bded24b05c761df16f1c80b1ba703
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxil.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\dxil.dll
        • Size 1.4MB
        • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\ffmpeg.dll
        • Size 3.0MB
        • SHA256 22e07be5d900ecad1fa47cbd9f783143af0058e18793b4804b887253988273ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\icudtl.dat
        • Size 10.4MB
        • SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\af.pak
        • Size 621KB
        • SHA256 3017b141bd16e24190d810f0748612f0fd4352ca8553002b9a63a7f77f7154f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\am.pak
        • Size 1005KB
        • SHA256 67b938d162bc75db067120bb8366b5bafd9a75fa99a0ca9ad4f46b47d1d37634
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ar.pak
        • Size 1.1MB
        • SHA256 4c47004abd0969cb1174d06eb7429c024872207960986afbf3cae37e339a8d01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\bg.pak
        • Size 1.1MB
        • SHA256 2eb9c74c67e4b13b45a73061fa978738e335bc245da71bab0ea9b205fe91074e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\bn.pak
        • Size 1.4MB
        • SHA256 415621a5c0b1546e6e447d43b76414425a8703cc7681d637ec1f283ad0c787e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ca.pak
        • Size 700KB
        • SHA256 6f28297c1ccb628f534d65dade167ae559f83eace359acf47e48ff890b9409d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\cs.pak
        • Size 725KB
        • SHA256 799a789ce531991cb975425730db310f9a8fe74091eee568f3e65fcc7ef0cd57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\da.pak
        • Size 650KB
        • SHA256 530fd95daee21d793b99492ca7d0bf9979daffe42944e24414d4b08a3d23b9fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\de.pak
        • Size 701KB
        • SHA256 58165025c4252ba8b2ce8203b59362b9968938cb0fef9d7da04941be22f41bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\el.pak
        • Size 1.2MB
        • SHA256 37d2e1ef69fea9bdb1e0902cbc61a458baa9009fc3761029bd1c1882a7a0c9b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\en-GB.pak
        • Size 566KB
        • SHA256 01d9200a5daee1770f7147b166d25baa6a8dd72c138c3c526421e656dec789f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\en-US.pak
        • Size 572KB
        • SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\es-419.pak
        • Size 691KB
        • SHA256 2766fd52da83ff679346313e66440f013a7d478b9be946df4ab197505912450b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\es.pak
        • Size 687KB
        • SHA256 fe6fff51ef19db1f4fe0fc602e0bd4bd7fabcfb1ca5d6896d1ce0efcf37e49c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\et.pak
        • Size 627KB
        • SHA256 dd1205eae606f12510e24ce39f301439c98b3293d766ca5839dc292a14d7973c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\fa.pak
        • Size 1.0MB
        • SHA256 ba33624ccad6d0e4a4339589c56be557b28968bf9422bd12a8f26e2a3d581577
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\fi.pak
        • Size 639KB
        • SHA256 1f3123d7fb5c22a95b5250ea17450b665c3c6cd6a6dfd28bbdde15e1bf684a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\fil.pak
        • Size 724KB
        • SHA256 02e2c70d3d85b0deb677a9ae576ae3cf89e80774532cb3315c14f1e8ce64b310
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\fr.pak
        • Size 745KB
        • SHA256 8bad7fd88072ac66649dd9307da9163962f8ab00313e627bf1c5ca4450a48b4a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\gu.pak
        • Size 1.4MB
        • SHA256 e86e8c240d4b6283abb03c49df9e8899607ef9def6d4933c7a541d63b5835271
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\he.pak
        • Size 906KB
        • SHA256 ddc1f304ab1f4489d19ae2b31e7f8e3ffb47dae439520159e8975422c65e4115
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\hi.pak
        • Size 1.5MB
        • SHA256 015b3856dc05e8635a48e749e6970fe43f5d620b8dbd04e5abff586178213f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\hr.pak
        • Size 698KB
        • SHA256 d46c64ae8af3562e37eb80438aa2bee228fafda251d58ba4d0991291f1c72aab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\hu.pak
        • Size 747KB
        • SHA256 0a46fc8d50f74effd1cfe1979e677df3de6fc47e6b551267303d93d57bd83f50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\id.pak
        • Size 620KB
        • SHA256 f567569c42a25bb2dfc5c33e13aac558c0e2a1d5d4b969592bbd0841b36438db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\it.pak
        • Size 677KB
        • SHA256 aeb1d99a2a09476d9ee0fd133df2d4d987c731b9f91a248ac4e60377ddda1ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ja.pak
        • Size 822KB
        • SHA256 f6e0d8eda3bc8f1112494bda96b230f3c44f054c47cced50c94c5ee9199f04c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\kn.pak
        • Size 1.6MB
        • SHA256 af5fed2130102ecc0c878059c88faed9d6db2e8b147fb5ae9e15e3fe69706c8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ko.pak
        • Size 701KB
        • SHA256 55a3a8db9c84b1fe9e50b56d68fb069ad7546117cf1f6cb89f36f49cc044ad5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\lt.pak
        • Size 759KB
        • SHA256 af969f4407c190dd01a426fa1244cb1ec7cdf2909d1c3ba5b87ff662ba567303
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\lv.pak
        • Size 756KB
        • SHA256 4455ab7c06172c2c80796a99558e41f452cc3b33be76654d70440cf4ac7a2d34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ml.pak
        • Size 1.7MB
        • SHA256 b5606265910e45098a88e989202a550531f6d00333c6b112ed4c5cbc07b2ff6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\mr.pak
        • Size 1.4MB
        • SHA256 8465d4077ed5414cbcb7d9bdb00d85e515a1a069703cdc1d4d67c9d6e5623fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ms.pak
        • Size 652KB
        • SHA256 af7021a00befa586aa067ae3ccb339079e6f13ee0cab1621836f6abb608b6f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\nb.pak
        • Size 623KB
        • SHA256 d97a2b0cbe6adc99add2ed3ce0d15d0bb124b778086c466c126634d60ea72608
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\nl.pak
        • Size 649KB
        • SHA256 b642c8ab5ce11438e9a8fd4639244fa8f1d55cfd70269565490bc55ee907b048
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\pl.pak
        • Size 724KB
        • SHA256 8a0969fc743d3e2f5111387d53c0d79e8c1d9f68256ad6553b87fca2bcaa7e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\pt-BR.pak
        • Size 680KB
        • SHA256 5546559a56f9ac3191062c3fd42defd190a68e78ac988eb57fa5a6fd2dc5f874
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\pt-PT.pak
        • Size 684KB
        • SHA256 bdfa7264dddf70f936f1785737969559a577b51d1952c820a468c611d18b17ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ro.pak
        • Size 711KB
        • SHA256 1e6b5b0dac63a9e951daf523de310f6bd9e5c53e281f37706d41bd35d2a08bb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ru.pak
        • Size 1.1MB
        • SHA256 a9e76536472c45b39e7ae2af5f3ae1bc0e50a11646efdb6fb3ca373b5f2e2c70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\sk.pak
        • Size 737KB
        • SHA256 3cdc8bca8696c90a572fb15c865caa5c286df45344c72194c3eea97201cc816a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\sl.pak
        • Size 705KB
        • SHA256 e1371c8df577b979e3a515af34b0aaa3d07153c7a5c55d39a9b49a7ffe62d3d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\sr.pak
        • Size 1.1MB
        • SHA256 c42a674e3f43aa70cef005931915c8b7ceb34b29566fba3309f8da931dc7861f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\sv.pak
        • Size 631KB
        • SHA256 7b0399a206bfbebe77d1a4fc598c8a6636a1bd940d3ab56519cf4af0134b6edb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\sw.pak
        • Size 669KB
        • SHA256 bd41ea707a0d90d683ec8d5d0f0c79f3e925747bc4ea1982562dfb75080199b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ta.pak
        • Size 1.7MB
        • SHA256 91fb1460711df108d8d435a378c8be1d1e80b0886c0158d8c6ae92f35812681b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\te.pak
        • Size 1.6MB
        • SHA256 fc8c2706c5dfd36e7af8e380a240e0f697cc5fe969b512092a2185896512c4af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\th.pak
        • Size 1.3MB
        • SHA256 c1f4235c31bc05153230b0e55b7aabc9020d7460d5b0a025c386885e1e4bda3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\tr.pak
        • Size 681KB
        • SHA256 d5648d7eaf1826211fb244fcf8419dabdc16c228d92139bc8b0b73c7a6b7e700
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\uk.pak
        • Size 1.2MB
        • SHA256 ec5d0b426e289c064e8f2d63636ae2a544ff30fc1e99dde04fe1920971e4d060
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\ur.pak
        • Size 1023KB
        • SHA256 c218e21744df2ff0669a87d497d65d76333073577360d4c662c592de146bf82a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\vi.pak
        • Size 810KB
        • SHA256 76a32f8ad5d08a6f9899e12e4aa9b3d9a9023931e2ca0f73e5ced541c922dcfb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\zh-CN.pak
        • Size 578KB
        • SHA256 7887bd3d01e12306e32a11d9a20566ca0e93688a0375e6ff59da04cf782b1681
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\locales\zh-TW.pak
        • Size 570KB
        • SHA256 7cb5f76e54a548d4e52aa8cdf226a4339bdadc304897abca690f407e95e42f4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources.pak
        • Size 11.9MB
        • SHA256 ee5707e9409e76742e1dacdae0ebbb3c567b8772ce5bbcb9785aa215f5784c22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CREDITS.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\demo-car\CREDITS.txt
        • Size 697B
        • SHA256 adac2e339b778a476b81c1b3da4c131da023c12d16f03587d963f7ec6f89059f
        • MD5 SHA1 SHA512 TLSH

        demo_car.mtl

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\demo-car\demo_car.mtl
        • Size 955B
        • SHA256 5aa22a65e4be236f699827dc70859b5044ce1b80d20954c124f4cfe08d49064d
        • MD5 SHA1 SHA512 TLSH

        demo_car.obj

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\demo-car\demo_car.obj
        • Size 5.5MB
        • SHA256 ff2ff7dad32c94fe33226fd04867065ce9c892ed566eb2c95de4c60493c90245
        • MD5 SHA1 SHA512 SSDEEP TLSH

        demo_car_atlas.png

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\demo-car\demo_car_atlas.png
        • Size 163KB
        • SHA256 caab9ebfb0535f5d5ee0856a40a0f30ad8ed5250bcc8a28fcce4fc58b04f14a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        demo_car_interior.png

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\demo-car\demo_car_interior.png
        • Size 515KB
        • SHA256 fedbde0d773251035d5a5fb84b2d4f0c34c63000a49439c9168989bf361864e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        demo_car_wheels.png

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\demo-car\demo_car_wheels.png
        • Size 141KB
        • SHA256 e2ea1638983db0d00032538080f094eaa57c6110dbb8ce680bbf7d0cc09f3d04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extension.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\beamng-importer\extension.json
        • Size 427B
        • SHA256 c40a9b8eed983336199e56c84def621ae83798f4242c49539da9c80ed74f37db
        • MD5 SHA1 SHA512 TLSH

        main.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\beamng-importer\main.js
        • Size 17KB
        • SHA256 1c3b4d4bf63dfd0924d34e8da282e6d9f4a5862faaa36591749ce31f7097f33f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extension.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\cms2021-importer\extension.json
        • Size 544B
        • SHA256 974f3e080308fbd7d3340d73fb32ff68c0e4e91f1bda33093a8028641072ac46
        • MD5 SHA1 SHA512 TLSH

        main.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\cms2021-importer\main.js
        • Size 6KB
        • SHA256 b7817f30cdcb4dd90a59f2f2b4bb5842fa901d90e1a3b6fc99a574a212ab353b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extension.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\forge-toolbox\extension.json
        • Size 278B
        • SHA256 c9ca9de4a0e0c6d00476877fe7d00ca4979c3ce9b2b7bd83163ed790745fc786
        • MD5 SHA1 SHA512 TLSH

        main.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\forge-toolbox\main.js
        • Size 2KB
        • SHA256 33ab6a2c48c86004ef7cc2a9e291b99fd67032e9928f26214d21f1b7517e557f
        • MD5 SHA1 SHA512 TLSH

        extension.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\mod-checklist\extension.json
        • Size 332B
        • SHA256 1b85448851ced98a543391e2f3fc0dcbff847883ff1e5ee082cc0d6341432a22
        • MD5 SHA1 SHA512 TLSH

        main.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\mod-checklist\main.js
        • Size 2KB
        • SHA256 dab2cef87c7072eb657ad105bc4c73b7228f0f86b607b50c66855dba626fb870
        • MD5 SHA1 SHA512 TLSH

        extension.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\quick-adjust\extension.json
        • Size 305B
        • SHA256 5c8a33a302fc00b5f20d965abd5432620cf8fc1c8becbd150b19787e72cf938c
        • MD5 SHA1 SHA512 TLSH

        main.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\quick-adjust\main.js
        • Size 3KB
        • SHA256 97ee96046c4055735751dbb60914b13a75a8fc6cf92a07ded01e901b5bb466c5
        • MD5 SHA1 SHA512 TLSH

        extension.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\warning-lights\extension.json
        • Size 323B
        • SHA256 c7daecae84854a953c2f43fb29cbb0ecffc74c6b87703fb42790c31cacd46415
        • MD5 SHA1 SHA512 TLSH

        main.js

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\example-extensions\warning-lights\main.js
        • Size 3KB
        • SHA256 8bf287ccf17df8e0195069a9c04bce5444d28bd758e5bc5694faea11a55dbb08
        • MD5 SHA1 SHA512 TLSH

        jbeam_forge.zip

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\resources\ingame\jbeam_forge.zip
        • Size 3.7MB
        • SHA256 1662e07ec73c17bf70b98aaf6f511cb8f2d54b8b110983e77cbed5dff3e52bf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\snapshot_blob.bin
        • Size 360KB
        • SHA256 132b5c838d93d5067c1de721b1b4d906b59289b3bb0a407925c228e621901a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\v8_context_snapshot.bin
        • Size 724KB
        • SHA256 d11a9fff344e9a6d067243ef85d4064716ea378098894f9a21bf8a1eeca66e53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 20938b3bb2da284a828d8b881a0954882a82620e57551ee3c93db3046b98c989
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\7z-out\vulkan-1.dll
        • Size 917KB
        • SHA256 17f4fb133bf92744913abe23202c3d6434fa84577746ad9fce18a74d1ec921c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss3BF7.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default.exc

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        data_0

        • Path C:\Users\Admin\AppData\Roaming\jbeam-forge\DawnGraphiteCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_2

        • Path C:\Users\Admin\AppData\Roaming\jbeam-forge\DawnGraphiteCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\jbeam-forge\DawnGraphiteCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        data_1

        • Path C:\Users\Admin\AppData\Roaming\jbeam-forge\GrShaderCache\data_1
        • Size 264KB
        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
        • MD5 SHA1 SHA512 SSDEEP

        CURRENT

        • Path C:\Users\Admin\AppData\Roaming\jbeam-forge\Local Storage\leveldb\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        Network Persistent State

        • Path C:\Users\Admin\AppData\Roaming\jbeam-forge\Network\Network Persistent State
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH

        Network Persistent State58ace9dc-d454-4f56-8f4d-b39081d3e0b9.tmp

        • Path C:\Users\Admin\AppData\Roaming\jbeam-forge\Network\Network Persistent State58ace9dc-d454-4f56-8f4d-b39081d3e0b9.tmp
        • Size 186B
        • SHA256 4e06e2fb7634aaf7d0566b028e7e3bf08e8c8fe7b6d8219efa3833bf07f89f16
        • MD5 SHA1 SHA512 TLSH

        main.log

        • Path C:\Users\Admin\AppData\Roaming\jbeam-forge\logs\main.log
        • Size 704B
        • SHA256 61039311be71b7b336b7ba3a71fbec8051370c6df416a7b3b3acd85456e3269f
        • MD5 SHA1 SHA512 TLSH

        memory/1536-521-0x00007FFFDEE00000-0x00007FFFDEE01000-memory.dmp

        memory/1536-522-0x00007FFFDDCC0000-0x00007FFFDDCC1000-memory.dmp

        memory/4788-635-0x00000207531C0000-0x00000207531C1000-memory.dmp

        memory/4788-636-0x00000207531C0000-0x00000207531C1000-memory.dmp

        memory/4788-633-0x00000207531C0000-0x00000207531C1000-memory.dmp

        memory/4788-634-0x00000207531C0000-0x00000207531C1000-memory.dmp

        memory/4788-637-0x00000207531C0000-0x00000207531C1000-memory.dmp

        memory/4788-638-0x00000207531C0000-0x00000207531C1000-memory.dmp

        memory/4788-627-0x00000207531C0000-0x00000207531C1000-memory.dmp

        memory/4788-629-0x00000207531C0000-0x00000207531C1000-memory.dmp